CIS.M365.1.1.3: Ensure that between two and four global admins are designated


ID	`CIS.M365.1.1.3`
Severity	High
Suite	CIS Microsoft 365 Foundations Benchmark
Product	Microsoft 365
Related products	Entra ID
Feature	Administrative accounts
Security area	Privileged access
Resource type	User
User impact of fixing	Low
Effort to fix	Medium
Benchmark	CIS Microsoft 365 Foundations Benchmark 7.0.0, `1.1.3` (L1, E3 Level 1)
Framework controls	`cis-m365:1.1.3` `nist-800-53-r5:AC-6(5)` Least Privilege \| Privileged Accounts
MITRE ATT&CK	T1078.004, T1098.003
Reads from	Microsoft Graph

What this checks and how to fix it

1.1.3 (L1) Ensure that between two and four global admins are designated

Between two and four Global Administrators should be designated in the tenant. Ideally, these accounts will not have licenses assigned to them which supports additional controls found in this benchmark.

Rationale

The Global Administrator role grants unrestricted access across all services in Microsoft Entra ID and should never be used for routine daily activities. Limiting the number of Global Administrators reduces the attack surface of the tenant and aligns with the principle of least privilege.

Fewer than two Global Administrators creates a single point of failure and removes the peer oversight needed to detect unauthorized actions. More than four increases the likelihood of account compromise by an external attacker. Maintaining between two and four Global Administrators balances operational redundancy against privileged access risk.

For any accounts assigned the Global Administrator role, at least one strong authentication method such as a FIDO2 key or certificate is strongly advised.

Impact

The potential impact associated with ensuring compliance with this requirement is dependent upon the current number of Global Administrators configured in the tenant. If there is only one Global Administrator in a tenant, an additional Global Administrator will need to be identified and configured. If there are more than four Global Administrators, a review of role requirements for current Global Administrators will be required to identify which of the users require Global Administrator access.

Remediation action

Note: If an organization’s tenant is using a third-party identity provider, this remediation may not be relevant. The principle of the recommendation is still relevant, and compensating controls that are relevant to the third-party identity provider should be implemented.

To correct the number of global tenant administrators:

Navigate to Microsoft 365 admin center https://admin.microsoft.com.
Select Users > Active Users.
In the Search field enter the name of the user to be made a Global Administrator.
To create a new Global Administrator:
Select the user’s name.
A window will appear to the right.
Select Manage roles.
Select Admin center access.
Check Global Administrator.
Click Save changes.

To remove Global Admins:

Select User.
Under Roles select Manage roles.
De-Select the appropriate role.
Click Save changes.

Note: When tallying the number of Global Administrators, Partner relationships (Settings > Partner Relationships) are not accounted for and should be reviewed on a recurring basis.

Mito check, based on CIS Microsoft 365 Foundations Benchmark. Author: NZLostboy; contributors: mrdos010. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).